Analysis
-
max time kernel
40s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 11:05
Behavioral task
behavioral1
Sample
Versatools.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Versatools.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
main.pyc
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
main.pyc
Resource
win10v2004-20240508-en
General
-
Target
main.pyc
-
Size
10KB
-
MD5
d0c341eb7e5bd3dc2b4530da7afcfd9d
-
SHA1
a464e88e39c1f2cded42f933a205b8786085c36f
-
SHA256
56b3e117751a7fd7b0bef0f90efa5f6b95af43ca0f03ea9bd1a7e1eac7b17cbb
-
SHA512
4d85b01fcfcc3f6a56758410b69b7117c2fc1beb8bfff5077a0f1b0170f9ed070ba05657384a254767b8044c73b1f94484f77a89125f331fa65536d88fade0f5
-
SSDEEP
192:IM5+HH/5vvWhOLmSe59njo0P0h5IYh+IhZjhcI4dRjjtu:IMmYHYvcYPmRRjjtu
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.pyc rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid Process 2684 AcroRd32.exe 2684 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid Process procid_target PID 2908 wrote to memory of 2664 2908 cmd.exe 29 PID 2908 wrote to memory of 2664 2908 cmd.exe 29 PID 2908 wrote to memory of 2664 2908 cmd.exe 29 PID 2664 wrote to memory of 2684 2664 rundll32.exe 30 PID 2664 wrote to memory of 2684 2664 rundll32.exe 30 PID 2664 wrote to memory of 2684 2664 rundll32.exe 30 PID 2664 wrote to memory of 2684 2664 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"3⤵
- Suspicious use of SetWindowsHookEx
PID:2684
-
-